diff options
| author | Bernhard Schmidt <berni@debian.org> | 2017-06-30 15:39:48 +0200 |
|---|---|---|
| committer | Bernhard Schmidt <berni@debian.org> | 2017-06-30 15:39:48 +0200 |
| commit | 5fe7875501a2560542b462f9af5bb3346214147f (patch) | |
| tree | 3d7dd77a282ed10ce7d06932ba404569f2e901b2 | |
| parent | a337e898bf9538be09e13cf50954df1cd4dc5815 (diff) | |
Adjust debian openvpn@.service
Adjust openvpn@.service to be similar to the upstream
openvpn-server@,service
In detail:
* Adjust Documentation URL to OpenVPN 2.4
* use systemd READY signalling (Type=notify)
* add ProtectHome=true
* Add After/Wants network-online.target, this should fix a few
bugs happening due to OpenVPN starting too early
* adjust CapabililtyBoundingSet
Closes: #858558, #864031
| -rw-r--r-- | debian/openvpn@.service | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/debian/openvpn@.service b/debian/openvpn@.service index a5e645f..53ff5a5 100644 --- a/debian/openvpn@.service +++ b/debian/openvpn@.service @@ -3,25 +3,25 @@ Description=OpenVPN connection to %i PartOf=openvpn.service ReloadPropagatedFrom=openvpn.service Before=systemd-user-sessions.service +After=syslog.target network-online.target +Wants=network-online.target Documentation=man:openvpn(8) -Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage +Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO [Service] +Type=notify PrivateTmp=true -KillMode=mixed -Type=forking +WorkingDirectory=/etc/openvpn ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid PIDFile=/run/openvpn/%i.pid ExecReload=/bin/kill -HUP $MAINPID -WorkingDirectory=/etc/openvpn -ProtectSystem=yes -CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_READ_SEARCH CAP_AUDIT_WRITE +CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE LimitNPROC=10 DeviceAllow=/dev/null rw DeviceAllow=/dev/net/tun rw +ProtectSystem=true +ProtectHome=true [Install] WantedBy=multi-user.target - - |